Cross site scripting

Sewio’s Real-Time Location System RTLS Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site scripting in its backup services. An attacker could take advantage of this vulnerability to execute arbitrary commands...

Out-of-bounds

Sewio’s Real-Time Location System RTLS Studio version 2.0.0 up to and including version 2.6.2 does not validate the length of RTLS report payloads during communication. This allows an attacker to send an exceedingly long payload, resulting in an out-of-bounds write to cause a denial-of-service...

CVE-2022-47911 CVE-2022-47911

Sewio’s Real-Time Location System RTLS Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system...

CVE-2022-47911 CVE-2022-47911

Sewio’s Real-Time Location System RTLS Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system...

CVE-2022-47395 CVE-2022-47395

Sewio’s Real-Time Location System RTLS Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its monitor services. An attacker could take advantage of this vulnerability to execute arbitrary maintenance operations and cause a denial-of-service...

CVE-2022-45444

Sewio RTLS Studio

CVE-2022-45444 CVE-2022-45444

Sewio’s Real-Time Location System RTLS Studio version 2.0.0 up to and including version 2.6.2 contains hard-coded passwords for select users in the application’s database. This could allow a remote attacker to login to the database with unrestricted access...

CVE-2022-45127

CVE-2022-45127 affects Sewio’s RTLS Studio, version 2.0.0 through 2.6.2. The vulnerability is a cross-site request forgery (CSRF) in the backup services, enabling an attacker to trigger arbitrary backup operations and cause a denial-of-service condition. The issue is documented across multiple so...

CVE-2022-43455 CVE-2022-43455

Sewio’s Real-Time Location System RTLS Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to the servicestart, servicestop, and servicerestart modules of the software. This could allow an attacker to start, stop, or restart arbitrary...

Sewio Real-Time Location System (RTLS) Studio 输入验证错误漏洞

Sewio Real-Time Location System RTLS Studio is a real-time location system from Sewio, Inc. An input validation error vulnerability exists in Sewio Real-Time Location System RTLS Studio versions 2.0.0 through 2.6.2, which stems from susceptibility to incorrect input validation of user input to th...

Sewio Real-Time Location System (RTLS) Studio 跨站脚本漏洞

Sewio Real-Time Location System RTLS Studio is a real-time location system from Sewio, Inc. A cross-site scripting vulnerability exists in Sewio's Real-Time Location System RTLS Studio versions 2.0.0 through 2.6.2, which stems from a backup service that is vulnerable to cross-site scripting. An...

Location Weather < 1.3.4 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC Exploit Additional CSS classes for "Location...

The vulnerability of Microsoft Exchange Server servers, related to access to a channel from a non-endpoint location, allows attackers to perform spoofing attacks.

The vulnerability of Microsoft Exchange Server lies in the access to the channel from a point that is not a final destination. Exploiting this vulnerability allows an attacker to perform spoofing attacks remotely...

PT-2023-15001 · Sewio · Sewio'S Real-Time Location System (Rtls) Studio

Name of the Vulnerable Software and Affected Versions: Sewio’s Real-Time Location System RTLS Studio versions 2.0.0 through 2.6.2 Description: The issue concerns cross-site scripting in the backup services of the software. An attacker could exploit this to execute arbitrary commands...

Sewio Real-Time Location System (RTLS) Studio 跨站请求伪造漏洞

Sewio Real-Time Location System RTLS Studio is a real-time location system from Sewio, Inc. A cross-site request forgery vulnerability exists in Sewio Real-Time Location System RTLS Studio versions 2.0.0 through 2.6.2, which stems from susceptibility to cross-site request forgery in its backup...

Location Weather < 1.3.4 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Exploit Additional CSS classes for "Location Weather"...

WordPress Location Weather Plugin < 1.3.4 is vulnerable to Cross Site Scripting (XSS)

Software Location Weather Type Plugin Vulnerable versions 1.3.4 Fixed in 1.3.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0360 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 1547b60d4821 Credits Lana Codes Required...

Enable Media Replace < 4.0.2 - Author+ Arbitrary File Upload

The plugin does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites. 1 As an Author, upload a picture via http://vulnerable-site.tld/wp-admin/upload.php 2 Press on the new picture's thumbnail to see the attachment's details 3...

Law enforcement app SweepWizard leaks data on crime suspects

SweepWizard, an obscure app apparently created by ODIN Intelligence and used by more than 60 law enforcement departments, has a flaw: According to an ethical hacker, a misconfiguration in the app's API application programming interface caused it to unintentionally leak to the open internet a trov...

PT-2023-14669 · Sewio · Sewio'S Real-Time Location System (Rtls) Studio

Name of the Vulnerable Software and Affected Versions: Sewio’s Real-Time Location System RTLS Studio versions 2.0.0 through 2.6.2 Description: The issue concerns hard-coded passwords for select users in the application’s database, which could allow a remote attacker to login to the database with...